O
Product Security Engineer
Contract type
Ongoing
Work mode
Remote · London
Experience
3 years
Job description
Orbital is hiring its first in-house Product Security Engineer to own the security of its AI agent product, the platform it runs on, and how it is built. The role focuses on building automated security harnesses, vulnerability management, AI agent security, and incident response.
At a glance
- Work mode
- Remote · London
What you'll do
- Build an automated security harness with continuous red-team and blue-team loops that probe the agent, the platform and the code, find vulnerabilities, and propose or ship the fix
- Own vulnerability management end to end: define severity classification and response times, automate patching, dependency and image scanning, and ensure findings reach an owner and get closed
- Secure an AI agent in production: threat-model how the agent handles untrusted documents, emails and web content, and the tools and sandboxes it uses; design defences against prompt injection and data exfiltration and test them
- Make security part of how we build: review designs and changes touching authentication, tenant isolation, secrets and data handling; turn recurring findings into automated checks
- Respond to security incidents: lead the technical response including containment, investigation and the fix; build the technical side of breach playbooks with the information security lead and run the review afterwards
- Choose and run security tooling: evaluate and roll out a cloud security platform (such as Wiz) and detection, alerting and logging across AWS and Azure
- Test our defences: run red-team exercises, manage external penetration testers, and run breach drills with engineering
- Close the loop on findings: fix what penetration tests and security researchers report, run responsible disclosure, and keep technical evidence for SOC 2 and ISO 27001 controls current
- Make the work visible: show leadership and engineering what the harness finds, what has been fixed and what risk remains, in plain language with a recommendation for each open risk
What we're looking for
- You build with agents: you'd rather put an agent loop on a problem than repeat a manual review, and you've used AI agents to find, triage or fix security issues
- Deep, hands-on security engineering experience: you've owned security for a cloud-native product or platform and can do the work yourself, from reading code and IAM policies to configuring detection and running an investigation
- You know AWS security well: IAM, network design, KMS, GuardDuty, Security Hub, CloudTrail and how they fit together in a real production environment
- You've led incident response, including containment, investigation, communication and follow-up, and stay clear-headed under pressure
- You take application and AI security seriously: you understand OWASP-class vulnerabilities and are interested in new risks from LLM agents such as prompt injection and over-broad tool access
- You understand the product and the business: you can tell a theoretical finding from one that puts customer data at risk and spend effort where the risk is real
- You help teams ship safely: you find the secure way to do what the team needs and block work only when the risk justifies it, explaining why clearly
- You work independently: as the first in-house product security engineer, you'll set your own priorities, build the programme, and know when to bring in outside help
- You bring people with you: you can explain a security risk to an engineer, a lawyer and a board member, adjusting detail for each, and change how teams work through influence rather than authority
- You'll most likely come from a security engineering, product security or application security role at a fast-growing startup, or from a security consultancy with hands-on delivery
Nice to have
- Experience securing LLM or agentic AI applications, or research into prompt injection and AI-specific threats
- Harness engineering experience: building the tooling, evaluation loops and guardrails that let AI agents do real engineering work
- Hands-on experience with SOC 2 and ISO 27001 audits
- Experience with Azure, Kubernetes or container security, or sandboxed code execution
- Familiarity with identity and SSO providers such as WorkOS or Okta
- Experience in legal, financial or other regulated industries
Apply
Direct apply at Orbital
Opens the job posting at Orbital
About Orbital
The AI platform for real estate legal work
Orbital is an AI platform for real estate legal work, built with former practising real estate lawyers and 250+ years of combined legal expertise. It is purpose-built for the complexity of real estate: accelerating due diligence, drafting and negotiation, and deal coordination with legal-grade precision.
Mission
To make real estate transactions faster, clearer, and less manual.
Key facts
- AI platform for real estate legal work
- Raised a $60m Series B led by Brighton Park Capital, $75m raised to date
- Trusted by 5,000+ real estate professionals, spanning UK Magic Circle and US Am Law 100 firms
- AWS environment follows the Well-Architected Framework with GuardDuty, Security Hub, encryption at rest and scoped credentials
- Holds SOC 2 and ISO 27001 commitments to customers
- Built with former practising real estate lawyers and 250+ years of combined legal expertise
Partners & customers
Brighton Park CapitalBCLPOrrickGoodwinWomble Bond DickinsonClifford ChanceM&S
What they value
- Security is everyone's responsibility
- Diverse and inclusive team
- Bold, ambitious team with trust to take ownership and make a real impact from day one